Re: [OE-core] [PATCH][dunfell][gatesgarth][master] cairo: whitelist CVE-2013-0800

["Richard Purdie" <richard.purdie@linuxfoundation.org>]

On Fri, 2021-01-15 at 12:47 +0200, Mikko Rapeli wrote:
> It affects only cairo embedded into Firefox.
> 
> https://security-tracker.debian.org/tracker/CVE-2013-0800
> 
> "The description is misleading: Firefox embeds a copy of Cairo, the interdiff
> shows the respective change at mozilla-esr17/gfx/cairo/cairo/src/cairo-image-surface.c
> Apparently the forked copy has changed, the code isn't present in vanilla Cairo"
> 
> Signed-off-by: Mikko Rapeli <mikko.rapeli@bmw.de>
> ---
>  meta/recipes-graphics/cairo/cairo_1.16.0.bb | 3 +++
>  1 file changed, 3 insertions(+)
> 
> diff --git a/meta/recipes-graphics/cairo/cairo_1.16.0.bb b/meta/recipes-graphics/cairo/cairo_1.16.0.bb
> index 8663dec404..29088ab0d6 100644
> --- a/meta/recipes-graphics/cairo/cairo_1.16.0.bb
> +++ b/meta/recipes-graphics/cairo/cairo_1.16.0.bb
> @@ -29,6 +29,9 @@ SRC_URI = "http://cairographics.org/releases/cairo-${PV}.tar.xz \
>             file://CVE-2019-6462.patch \
>            "
>  
> 
> 
> 
> +# Affects only embedded cairo in Firefox
> +CVE_CHECK_WHITELIST += "CVE-2013-0800"
> +

That sounds a lot like we should send a CPE change upstream to classify
it as firefox rather than cairo?

Cheers,

Richard